xtremerat | 95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d

General

Target

95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe
Size

50KB
MD5

2e43371f1d086aac9f65c5c6005f342a
SHA1

ec61fd33aed4e4ebdb158080f2812a623acda81d
SHA256

95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d
SHA512

e90ef3dd6c28bfb4604ae3624aa369bff937f1c81154f327809ab7edd326b49d47818d9ee998124a0097b562e912a0d5a660355ae79025c4cad0b14bda821a42
SSDEEP

768:Zg1rwwyTR9Ywp8PXk/XIZNXSCOWMEPbz5iO9i7xRqEX1q:+cXl9hSs/IZNCCOEYO9M1s

Score

10^/10

xtremerat persistence rat spyware upx

Malware Config

Signatures

Detect XtremeRAT payload 6 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3272-138-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/3272-139-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/4420-140-0x0000000000000000-mapping.dmp	family_xtremerat
behavioral2/memory/4420-141-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/3272-142-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat
behavioral2/memory/4420-143-0x0000000010000000-0x000000001004A000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3272-135-0x0000000010000000-0x000000001004A000-memory.dmp	upx
behavioral2/memory/3272-137-0x0000000010000000-0x000000001004A000-memory.dmp	upx
behavioral2/memory/3272-138-0x0000000010000000-0x000000001004A000-memory.dmp	upx
behavioral2/memory/3272-139-0x0000000010000000-0x000000001004A000-memory.dmp	upx
behavioral2/memory/4420-141-0x0000000010000000-0x000000001004A000-memory.dmp	upx
behavioral2/memory/3272-142-0x0000000010000000-0x000000001004A000-memory.dmp	upx
behavioral2/memory/4420-143-0x0000000010000000-0x000000001004A000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

Processes:

95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe

description	pid	process	target process
PID 4512 set thread context of 3272	4512	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

5072 4420 WerFault.exe svchost.exe
3604 4420 WerFault.exe svchost.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe

pid process

4512 95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe

pid	pid_target	process	target process
5072	4420	WerFault.exe	svchost.exe
3604	4420	WerFault.exe	svchost.exe

pid	process
4512	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe

description	pid	process	target process
PID 4512 wrote to memory of 3272	4512	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe
PID 4512 wrote to memory of 3272	4512	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe
PID 4512 wrote to memory of 3272	4512	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe
PID 4512 wrote to memory of 3272	4512	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe
PID 4512 wrote to memory of 3272	4512	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe
PID 4512 wrote to memory of 3272	4512	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe
PID 4512 wrote to memory of 3272	4512	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe
PID 4512 wrote to memory of 3272	4512	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe
PID 3272 wrote to memory of 4420	3272	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe	svchost.exe
PID 3272 wrote to memory of 4420	3272	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe	svchost.exe
PID 3272 wrote to memory of 4420	3272	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe	svchost.exe
PID 3272 wrote to memory of 4420	3272	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe	svchost.exe
PID 3272 wrote to memory of 4992	3272	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe	msedge.exe
PID 3272 wrote to memory of 4992	3272	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe	msedge.exe
PID 3272 wrote to memory of 4992	3272	95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe
"C:\Users\Admin\AppData\Local\Temp\95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4512

C:\Users\Admin\AppData\Local\Temp\95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe
"C:\Users\Admin\AppData\Local\Temp\95f0eb65e5233d71a347b44b074efe3eae5e63ef58e9415cdc6e41077a6a104d.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:3272

C:\Windows\SysWOW64\svchost.exe
svchost.exe
3⤵
PID:4420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4420 -s 480
4⤵
- Program crash
PID:5072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4420 -s 488
4⤵
- Program crash
PID:3604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
3⤵
PID:4992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4420 -ip 4420
1⤵
PID:4924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4420 -ip 4420
1⤵
PID:3356

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3272-134-0x0000000000000000-mapping.dmp

Download
memory/3272-135-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/3272-137-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/3272-138-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/3272-139-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/3272-142-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/4420-140-0x0000000000000000-mapping.dmp

Download
memory/4420-141-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download
memory/4420-143-0x0000000010000000-0x000000001004A000-memory.dmp

Filesize
296KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads